IMMUTABLE DATA PROTECTION FOR ANY APPLICA TION

1 Knowledge Sharing Article 2020 Dell Inc. or its subsidiaries. IMMUTABLE data PROTECTION FOR ANY APPLICATIONMike van der SteenPrincipal Systems EngineerDell Dell Technologies Proven Professional Knowledge Sharing 2 The Dell Technologies Proven Professional Certification program validates a wide range of skills and competencies across multiple technologies and products. From Associate, entry-level courses to Expert-level, experience-based exams, all professionals in or looking to begin a career in IT benefit from industry-leading training and certification paths from one of the world s most trusted technology partners. Proven Professional certifications include: Cloud Converged/Hyperconverged Infrastructure data PROTECTION data Science Networking Security Servers Storage enterprise ArchitectCourses are offered to meet different learning styles and schedules, including self-paced On Demand, remote-based Virtual Instructor-Led and in-person Classrooms. Whether you are an experienced IT professional or just getting started, Dell Technologies Proven Professional certifications are designed to clearly signal proficiency to colleagues and employers.

2 Learn more at 3 Table of Contents Introduction .. 4 Protecting data from Cyber-Attacks .. 4 Available Solutions .. 5 Protecting Any Application data Beyond the Current Solutions .. 5 Dell Technologies PowerProtect DD Series Appliance .. 5 Logical Layout with MTrees .. 5 Immutability with Retention Lock .. 6 Enforcing Retention Lock on data .. 7 Independent Copies with Fast Copy .. 8 Solution Overview of IMMUTABLE data PROTECTION for Any Application .. 9 Creating IMMUTABLE data Copies .. 9 Recovery of Protected data .. 13 Scripting the Solution for Automatic PROTECTION .. 16 Configure the Private/Public Key for Client-Side Scripting .. 16 Sample Shell Script to Create and Remove Fast Copy Instances .. 17 Scheduling the Script to Run Automatically .. 19 IMMUTABLE data PROTECTION Example for Avamar .. 20 Solution Requirements .. 20 Protecting Avamar Backups .. 22 Recovering Avamar and Protected data .. 24 Summary .. 35 References .. 35 Disclaimer: The views, processes or methodologies published in this article are those of the author.

3 They do not necessarily reflect Dell Technologies views, processes or methodologies. 2020 Dell Technologies Proven Professional Knowledge Sharing 4 Introduction Most organizations have data PROTECTION as a top priority to ensure business continuity and this is even more relevant today with the prevalence of Cyber-attacks. While these Cyber-attacks traditionally originate from a source external to the organization, attacks from bad actors internal to the organization is unfortunately a real threat. Mitigation strategies to protect the organization s data includes hardening of operating systems, applications and devices. Additionally, regular backups must be taken of the data to provide a level of PROTECTION , but these do not safeguard data when the threat attacks both the backup systems and the data itself. Dell Technologies PowerProtect DD Series appliances3 (formally known as Dell EMC data Domain and will be referred to as data Domain in this article) provide Retention Lock capability.

4 This feature, when enabled and applied to data stored on the appliance, prevents that data from being deleted or modified in any way. This results in backup data being stored on the appliance in an IMMUTABLE manner. This Knowledge Sharing article provides an overview of the fundamental data Domain features leveraged to create IMMUTABLE copies of backup data , the process of creating them, the recovery process and a sample script to automate the daily tasks of creating these IMMUTABLE copies. An example is provided for creating IMMUTABLE copies of backups taken with Dell Technologies Avamar and the recovery process. Avamar is used as an example as this backup application at the time of writing this article does not have the capability to natively integrate with data Domain Retention Lock feature. While the primary focus of this article is based on backup applications, it can be extended to incorporate any application storing data on data Domain, hence providing IMMUTABLE data PROTECTION for any application.

5 Protecting data from Cyber-Attacks There are several strategies that can be implemented to protect the organizations data from Cyber-attacks or internal bad actors. Dell Technologies recognizes the need to safeguard data and discuss the Good, Better, and Best in a Layered Cyber Security for data PROTECTION approach as shown in Figure 1. Figure 1- Dell Technologies layered Cyber security for data protection1 5 The base layer or a good level of PROTECTION is achieved by performing regular backups of the organization s data . The second layer or better level of data PROTECTION requires hardening of the backup application and appliances. In addition, leveraging retention lock capability to ensure data is stored in an IMMUTABLE manner. Finally, the last layer or best level of data PROTECTION requires a cyber recovery solution where the organization s most valuable data is stored in a separate or air-gapped environment. This solution focuses on providing a better level of data PROTECTION for those applications that do not integrate natively with data Domain Retention Lock and enabling protected data to be stored in an IMMUTABLE manner.

6 Available Solutions Dell Technologies data PROTECTION portfolio includes a Cyber Recovery Solution2 where data is safeguarded in an isolated environment designed to protect the organization s most critical applications. This type of data normally represents a small percentage of the overall data managed by the organization s Information Technology (IT) department. Organizations that use NetWorker4 and/or PowerProtect data Manager5 have native integration with data Domain Retention Lock feature. This enables those organizations to achieve a better level of data PROTECTION . Protecting Any Application data Beyond the Current Solutions There are numerous data PROTECTION applications in the market. Some applications, including Dell Technologies Avamar are unable to leverage data Domain Retention Lock natively, which means that data protected by Avamar is not stored in an IMMUTABLE state. To help organizations achieve a better level of data PROTECTION by storing PROTECTION data in an IMMUTABLE state, a scripted based solution is provided in this article.

7 While the primary focus of this solution was designed for organizations using Avamar, it can in fact be applied to any application writing data to a data Domain appliance. Dell Technologies PowerProtect DD Series Appliance At the core of the solution described in this article and of any Dell Technologies data PROTECTION solution is the PowerProtect DD Series appliance, otherwise known as data Domain. data Domain is not exclusive to Dell Technologies data PROTECTION solutions and is used with many industry-leading data PROTECTION software applications. There are numerous key features which make it a perfect PROTECTION storage platform for organizations, including its variable length deduplication algorithm, global deduplication within each appliance and the data Invulnerability architecture to name just a few. Features relevant to the solution including MTrees, Retention Lock and Fast Copy, are explored in detail. Additional information about these and other features of data Domain can be found in the data Domain Operating System Administration Guide8 and Command Reference Guide9.

8 Logical Layout with MTrees When a data Domain appliance is initially configured, it has a single file system and MTrees are created to provide logical partitions of that single file system. An MTree is a directory in its simplest form, however it allows for granular operations to be performed on the MTree, which include defining security access, quotas, replication, Retention Lock and creating snapshots. 2020 Dell Technologies Proven Professional Knowledge Sharing 6 When applications are configured to write data to data Domain, they are directed to use a predefined MTree. The MTree can be exposed to the application via Virtual Tape Library (VTL), Common Internet File System (CIFS), Network File System (NFS) or as a data Domain Boost device. For future reference, when a data Domain Boost (DDBoost) device is created, it is referred to as a Logical Storage Unit (LSU) within the Dell Technologies documentation and this is linked to an MTree on the data Domain appliance.

9 Figure 2 shows a list of MTrees that exist on data Domain appliance called DD01. The first three MTrees are assigned to Avamar applications, while the last two MTrees are used by Dell Technologies PowerProtect data Manager. For reference, the backup MTree is created by default at the time the data Domain File System is initialized and normally not used by applications. sysadmin@dd01# mtree list Name Pre-Comp (GiB) Status ---------------------------------------- ------------ --------------------- --------- / data /col1/avamar-1577926088 RW / data /col1/avamar-1577931553 RW / data /col1/avamar-1577945908 RW / data /col1/backup RW / data /col1/Default RW / data /col1/pp01-dr RW / data /col1/VM_Images_-_DR-pp01-af1ac RW/RLGE ---------------------------------------- ------------ --------------------- --------- D : Deleted Q : Quota Defined RO : Read Only RW : Read Write RD.

10 Replication Destination RLGE : Retention-Lock Governance Enabled RLGD : Retention-Lock Governance Disabled RLCE : Retention-Lock Compliance Enabled Figure 2 - List of MTrees on data Domain appliance DD01 When individual credentials are set for every MTree or LSU, it provides an additional layer of security to ensure data written by one application cannot be accessed by another. Immutability with Retention Lock The Retention Lock feature was introduced many years ago and is included as a standard feature with any data Domain appliances running DD OS or greater. Retention Lock can be applied to a MTree either as Governance or Compliance mode, but not both. With Retention Lock applied to data , that data cannot be modified, overwritten or deleted for the set period as defined by the Retention Lock settings. There are two Retention Lock options available on the data Domain appliance; Governance and Compliance modes. In Governance mode, data is retained for a specific time period that aligns with the organization s internal IT governance policy and implemented by the system administrator.